You are viewing a plain text version of this content. The canonical link for it is here.
Posted to repository@apache.org by Stefano Bagnara <ap...@bago.org> on 2007/05/14 10:45:47 UTC
artifactIds and "apache-" prefix for trademark-enabled artifacts
Yesterday I was talking to Robert Burrell Donkin on Apache JAMES dev
list about a work-in-progress release of our mime4j product.
You can read the whole thread:
http://mail-archives.apache.org/mod_mbox/james-server-dev/200705.mbox/%3cf470f68e0705130612p6daba5cdve31969c139a8427e@mail.gmail.com%3e
A summary is that there is an (maybe unwritten) ASF policy requiring us
to use the "apache-" prefix in every redistributable artifact so to
enable trademark law to be used against anyone passing off bad packages.
Browsing the apache m2 repository I found very few products using the
prefix.
Of course the short-term solution is to add the "apache-" prefix to all
of our artifactId but I wanted to spread the word and to hear your
suggestions on how to make this "policy" more widely adopted by ASF
products.
E.g: maybe that an apache m2 plugin could be developed to check that the
artifactId begins with "apache-" or complain with a text and added to
the apache root pom? I think that similar technical solutions are much
more effective than any documentation page :-)
Stefano
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Craig L Russell <Cr...@Sun.COM>.
Before maven changes anything, can we please have a real proposal
with examples of old and new path/file names, and a discussion? This
affects a large number of projects, and needs a thorough vetting.
Craig
On May 16, 2007, at 1:40 PM, Robert Burrell Donkin wrote:
> On Wed, 2007-05-16 at 09:30 -0700, Carlos Sanchez wrote:
>> just talk so far, the different plugins that create packages
>> should be
>> modified (war, ear, assembly,...) The first ones are probably
>> going to
>> be the eclipse, bundle and the OSGi related ones.
>>
>> if it becomes an apache policy officially, well then we'll do it
>> faster I guess, but I just wanted to let people know that it's in the
>> roadmap, and sounds a better solution that just append "apache" to
>> all
>> artifactIds
>
> IIRC this used to be a recommendation in the old days (before maven
> did
> away with prefixes). don't recall the board every passing anything and
> it was never written down as policy (during the period when policy was
> being written down).
>
> not sure if it'll become official policy unless there are issues
> downstream again (which seems less likely these days)
>
> - robert
Craig Russell
Architect, Sun Java Enterprise System http://java.sun.com/products/jdo
408 276-5638 mailto:Craig.Russell@sun.com
P.S. A good JDO? O, Gasp!
Re: artifactIds and "apache-" prefix for trademark-enabled
artifacts
Posted by Robert Burrell Donkin <rd...@apache.org>.
On Wed, 2007-05-16 at 09:30 -0700, Carlos Sanchez wrote:
> just talk so far, the different plugins that create packages should be
> modified (war, ear, assembly,...) The first ones are probably going to
> be the eclipse, bundle and the OSGi related ones.
>
> if it becomes an apache policy officially, well then we'll do it
> faster I guess, but I just wanted to let people know that it's in the
> roadmap, and sounds a better solution that just append "apache" to all
> artifactIds
IIRC this used to be a recommendation in the old days (before maven did
away with prefixes). don't recall the board every passing anything and
it was never written down as policy (during the period when policy was
being written down).
not sure if it'll become official policy unless there are issues
downstream again (which seems less likely these days)
- robert
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Carlos Sanchez <ca...@apache.org>.
just talk so far, the different plugins that create packages should be
modified (war, ear, assembly,...) The first ones are probably going to
be the eclipse, bundle and the OSGi related ones.
if it becomes an apache policy officially, well then we'll do it
faster I guess, but I just wanted to let people know that it's in the
roadmap, and sounds a better solution that just append "apache" to all
artifactIds
On 5/16/07, Stefano Bagnara <ap...@bago.org> wrote:
> Carlos Sanchez ha scritto:
> > A couple of things
> >
> > - we just talked lately about using groupId+artifactId as filename for
> > distributions, assemblies and other things that end in an expanded
> > directory structure, to avoid conflicts and unnecessary long
> > artifactIds, but seems that it would also solve this problem
> >
> > eg. org.apache.maven/1.0/core-1.0.jar would end in
> > org.apache.maven.core-1.0.jar inside the distribution automatically
>
> Well, this seems to be anyway a good news. Where can I track this
> "change" ? (is there a JIRA issue / a mailing list thread / an svn
> folder I can monitor)
>
> Thank you,
> Stefano
>
>
--
I could give you my word as a Spaniard.
No good. I've known too many Spaniards.
-- The Princess Bride
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Stefano Bagnara <ap...@bago.org>.
Carlos Sanchez ha scritto:
> A couple of things
>
> - we just talked lately about using groupId+artifactId as filename for
> distributions, assemblies and other things that end in an expanded
> directory structure, to avoid conflicts and unnecessary long
> artifactIds, but seems that it would also solve this problem
>
> eg. org.apache.maven/1.0/core-1.0.jar would end in
> org.apache.maven.core-1.0.jar inside the distribution automatically
Well, this seems to be anyway a good news. Where can I track this
"change" ? (is there a JIRA issue / a mailing list thread / an svn
folder I can monitor)
Thank you,
Stefano
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Carlos Sanchez <ca...@apache.org>.
A couple of things
- we just talked lately about using groupId+artifactId as filename for
distributions, assemblies and other things that end in an expanded
directory structure, to avoid conflicts and unnecessary long
artifactIds, but seems that it would also solve this problem
eg. org.apache.maven/1.0/core-1.0.jar would end in
org.apache.maven.core-1.0.jar inside the distribution automatically
i'm aware that that wouldn't prevent people from randomly download
core-1.0.jar by hand
- everything under org.apache in the repo comes from the apache
server, the rest of the projects that are not under org.apache (eg
ant) are a bit harder to enforce but they are not accepted from the
manual upload procedure.
On 5/16/07, Stefano Bagnara <ap...@bago.org> wrote:
> Steve Loughran ha scritto:
> > How would an apache- tag prevent that?
> >
> > If I wanted to submit a hacked version I'd offer my own repository as
> > a mirror and serve different artifacts to people with .mil domains
> > from the rest of the world...you wouldn't even see a difference if you
> > audited the repository against other site's md5 files unless you came
> > from the domain I was targeting.
>
> Again, this is only my (IANAL) understanding: In this case ASF could sue
> you because you are abusing his trademark.
>
> Stefano
>
>
--
I could give you my word as a Spaniard.
No good. I've known too many Spaniards.
-- The Princess Bride
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Stefano Bagnara <ap...@bago.org>.
Steve Loughran ha scritto:
> How would an apache- tag prevent that?
>
> If I wanted to submit a hacked version I'd offer my own repository as
> a mirror and serve different artifacts to people with .mil domains
> from the rest of the world...you wouldn't even see a difference if you
> audited the repository against other site's md5 files unless you came
> from the domain I was targeting.
Again, this is only my (IANAL) understanding: In this case ASF could sue
you because you are abusing his trademark.
Stefano
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Steve Loughran <st...@gmail.com>.
On 16/05/07, Stefano Bagnara <ap...@bago.org> wrote:
> If you make your own distribution of any apache project you should
> change the groupId and the artifactId, so that no one will ever be
> confused between an official apache distribution and your own
> distribution (this is also a maven best practice: you should never
> deploy to any repository a changed artifact without altering the
> artifactId, groupId and the version, otherwise this will lead to
> incompatibilities as artifacts are cached in local repositories using
> this informations as the "primary key").
1. maven best practices are not a concern of me :)
2. yes, I do regularly stick custom builds of things into the private
repos, giving them some kind of version like "47.steve".
Why?
Because then by adjusting the version properties file I can switch
between the official versions and my own releases, and back again. If
I had to edit the other bits of the pom/ivy.xml files then I'd have
maintenance problems.
>
> 1) As far as I understood it, the "apache-" prefix is there also because
> tomorrow someone could create a "www.geronimo.com" domain and start
> distributing an hacked version of geronimo using the same package names
> are official geronimo artifacts and if they don't use the "Apache" brand
> they are entitled to do that (I don't know anything of the specific
> geronimo case, this is just an example). Using apache will let ASF to
> protect this.
>
> 2) Maybe this even more valid with maven repositories. How can we make
> sure that no one deploys artifacts hacked versions of apache products in
> the maven repository using the same artifactId if the file name does not
> include apache?
> Let's say tomorrow I submit to ibiblio an ant-javamail-1.6.6.jar in
> the http://mirrors.ibiblio.org/pub/mirrors/maven2/ant/ant-javamail/ folder.
Carlos would want to see the PGP-signed release announcement that
included the MD5 sums of your artifact. And the ant team would start
sending you support calls related to the mail task. You want to submit
something malicious, don't submit apache artifacts...submit third
party ones.
> Let's say I submit an hacked version where instead of sending mail I
> send viruses around the world or I make it to send a copy to some "spy"
> address.
How would an apache- tag prevent that?
If I wanted to submit a hacked version I'd offer my own repository as
a mirror and serve different artifacts to people with .mil domains
from the rest of the world...you wouldn't even see a difference if you
audited the repository against other site's md5 files unless you came
from the domain I was targeting.
-steve
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Stefano Bagnara <ap...@bago.org>.
Steve Loughran ha scritto:
> On 16/05/07, Jason Dillon <ja...@planet57.com> wrote:
>> I'm all for protecting things... but if that means putting "apache-"
>> in-front of everything... then I'm not sure how well that is going to
>> fly with the rest of the community.
>>
>
> Here's a problem I have with the apache- prefix.
>
> 1. I have the right to cut my own distributions of any apache project
> 2. I have the right to publish them to any private repository, where
> that includes repositories private to the two class-A domains of my
> employers, i.e. 1/128 of the entire IPV4 address space.
> 3. but if the artifacts have apache- in the front, then surely I am
> claiming my private artifacts are in fact apache distros, when unless
> I am the release manager for an artifact, and follow the formal
> release process, that is not the case.
I think that the "apache-" prefix advice is mainly intended to avoid
this to happen.
If you make your own distribution of any apache project you should
change the groupId and the artifactId, so that no one will ever be
confused between an official apache distribution and your own
distribution (this is also a maven best practice: you should never
deploy to any repository a changed artifact without altering the
artifactId, groupId and the version, otherwise this will lead to
incompatibilities as artifacts are cached in local repositories using
this informations as the "primary key").
1) As far as I understood it, the "apache-" prefix is there also because
tomorrow someone could create a "www.geronimo.com" domain and start
distributing an hacked version of geronimo using the same package names
are official geronimo artifacts and if they don't use the "Apache" brand
they are entitled to do that (I don't know anything of the specific
geronimo case, this is just an example). Using apache will let ASF to
protect this.
2) Maybe this even more valid with maven repositories. How can we make
sure that no one deploys artifacts hacked versions of apache products in
the maven repository using the same artifactId if the file name does not
include apache?
Let's say tomorrow I submit to ibiblio an ant-javamail-1.6.6.jar in
the http://mirrors.ibiblio.org/pub/mirrors/maven2/ant/ant-javamail/ folder.
Let's say I submit an hacked version where instead of sending mail I
send viruses around the world or I make it to send a copy to some "spy"
address.
IANAL, but if I understood it correctly if they used the "apache-"
prefix ASF would have one more weapon (the trademark law) to stop
similar behavior.
> so, -1 on process grounds, and -1 because you can take branding too
> far. Should we rewrite all the ant and maven docs to tell people to
> install into ApacheAnt and ApacheMaven dirs, and rename the env
> variables APACHE_ANT_HOME and APACHE_MAVEN_HOME? I think not.
I think that this is only needed for redistributable packages.
Environment variables and folders are not involved in this "advice".
Stefano
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Jason Dillon <ja...@planet57.com>.
On May 16, 2007, at 4:21 AM, Steve Loughran wrote:
> On 16/05/07, Jason Dillon <ja...@planet57.com> wrote:
>> I'm all for protecting things... but if that means putting "apache-"
>> in-front of everything... then I'm not sure how well that is going to
>> fly with the rest of the community.
>>
>
> Here's a problem I have with the apache- prefix.
>
> 1. I have the right to cut my own distributions of any apache project
> 2. I have the right to publish them to any private repository, where
> that includes repositories private to the two class-A domains of my
> employers, i.e. 1/128 of the entire IPV4 address space.
> 3. but if the artifacts have apache- in the front, then surely I am
> claiming my private artifacts are in fact apache distros, when unless
> I am the release manager for an artifact, and follow the formal
> release process, that is not the case.
>
> so, -1 on process grounds, and -1 because you can take branding too
> far. Should we rewrite all the ant and maven docs to tell people to
> install into ApacheAnt and ApacheMaven dirs, and rename the env
> variables APACHE_ANT_HOME and APACHE_MAVEN_HOME? I think not.
Ya, no kidding that leads to naming all classes Apache*, all scripts
apache-* and really any other file apache-*.
But seriously... for the *official release assemblies*... I'm more
than happy to name the jars apache-* (as in apache-geronimo-javaee-
jetty-2.0.zip, vs. geronimo-javaee-jetty-2.0.zip).
BUT for the myrdiad of (er ~200+ modules) that make up that
distribution.... I really, really, really thing that the groupId or
org.apache.* should suffice.
IMO if there is a legal problem with this, then we need to get with
the lawyers and sort our how we can be legally covered with our Maven
artifacts.
--jason
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Steve Loughran <st...@gmail.com>.
On 16/05/07, Jason Dillon <ja...@planet57.com> wrote:
> I'm all for protecting things... but if that means putting "apache-"
> in-front of everything... then I'm not sure how well that is going to
> fly with the rest of the community.
>
Here's a problem I have with the apache- prefix.
1. I have the right to cut my own distributions of any apache project
2. I have the right to publish them to any private repository, where
that includes repositories private to the two class-A domains of my
employers, i.e. 1/128 of the entire IPV4 address space.
3. but if the artifacts have apache- in the front, then surely I am
claiming my private artifacts are in fact apache distros, when unless
I am the release manager for an artifact, and follow the formal
release process, that is not the case.
so, -1 on process grounds, and -1 because you can take branding too
far. Should we rewrite all the ant and maven docs to tell people to
install into ApacheAnt and ApacheMaven dirs, and rename the env
variables APACHE_ANT_HOME and APACHE_MAVEN_HOME? I think not.
-steve
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Jason Dillon <ja...@planet57.com>.
On May 16, 2007, at 2:19 AM, Stefano Bagnara wrote:
>> IMO, there is no reason to prefix each and every artifact's filename
>> produce by an ASF project with "apache-"... assembly zip/tgz okay,
>> maybe... but for other Maven artifacts I belive that the org.apache
>> groupId should be sufficient.
>
> IMHO is not about your opinion or my opinion, it is about what ASF
> lawyers can do to prevent others to distribute "fake" versions of our
> products.
Sure ;-)
> One of the tools ASF can use is the trademark law and to do that we
> have
> to use "apache" in the file name.
>
> Why should Maven artifacts follow a different procedure that other
> redistributable packages? As maven repositories do redistribute
> artifacts it would really help to have this apache prefix. ActiveMQ
> just
> followed this practice (apache-activemq in the artifactId)
The ActiveMQ folks have updated their build to generate assembly (zip
and tar.gz) artifact filename prefixed with "apache-", but *most* of
the Maven generated artifacts for the project are not prefixed with
"apache-":
http://repo1.maven.org/maven2/org/apache/activemq/
Instead they are prefixed with "activemq-" and contained with in the
org.apache.activemq group.
What I read into the email was that "apache-" needs to be on each and
every redistributed file, which turns this list:
activemq-console/
activemq-core/
activemq-jaas/
activemq-openwire-generator/
activemq-optional/
activemq-parent/
activemq-ra/
activemq-rar/
activemq-test-atomikos/
activemq-web-console/
activemq-web-demo/
activemq-web/
activemq-xmpp/
apache-activemq/
tooling/
into:
apache-activemq-console/
apache-activemq-core/
apache-activemq-jaas/
apache-activemq-openwire-generator/
apache-activemq-optional/
apache-activemq-parent/
apache-activemq-ra/
apache-activemq-rar/
apache-activemq-test-atomikos/
apache-activemq-web-console/
apache-activemq-web-demo/
apache-activemq-web/
apache-activemq-xmpp/
apache-activemq/
apache-tooling/
(I'm not even going to try and show the before/after for Apache
Geronimo... but just a note, right now there are 277 modules in
server/trunk. Most have artifactId's prefixed with "geronimo-",
though most config modules don't have any prefix at all).
Since each of these dirs represents an artifact, or in some cases a
set of artifacts... and each and every one of them have an POM
artifact, that pretty much means adding "apache-" to each and every
ASF projects modules (er artifactIds) using Maven or Maven2.
I'm all for protecting things... but if that means putting "apache-"
in-front of everything... then I'm not sure how well that is going to
fly with the rest of the community.
I personally believe that Maven artifacts should be considered
different than project release archives.
We already put META-INF/LICENSE.txt and META-INF/NOTICE.txt (and in
some cases META-INF/DISCLAIMER.txt) into each and every jar/zip/tgz
artifact.... isn't that sufficient to protect the artifact and its
contents?
--jason
> Our to be
> released Mime4J has just been updated to artifactId=apache-mime4j. If
> maven or the repository does not give us another option I think the
> only
> option we (we: PMC wanting to team with ASF in order to protect our
> rights) have is to change all of our artifactIds. I don't like this
> too
> much, but if we don't have any better technical solution to this
> policy
> advice I will do that (and I hope others PMC too).
>
> Btw, as I know ant/ivy/osgi/maven people is discussing repositories I
> just think this is an important advice from the ASF and I hope people
> will take this into consideration.
>
> We all already loose so much time discussing and managing
> NOTICE/LICENSE/headers/ICLA/CCLA/copyrights and whatever that it would
> be a pity if ASF could not defend our work because of a silly missing
> prefix.
>
> Stefano
>
> PS: if you are a lawyer then forget about what I wrote and please
> get in
> touch with Robert because you have different convictions. I don't have
> the skills to evaluate the legal impact of using or not using the
> prefix, I'm just trying to find the best technical solution to a
> requirement.
>
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Stefano Bagnara <ap...@bago.org>.
Jason Dillon ha scritto:
> It would be a incredible pity if we had to prefix *every artifact* with
> "apache-". I believe that wrt to Maven artifacts that the "org.apache."
> groupId prefix should suffice. Perhaps for distribution assemblies if
> we want to prefix everything with "apache-" that should be fine (which
> it would be nice to get some official clarification and documentation on
> this policy) .
>
> But., for the artifacts themselves... do we really need this? Apache
> Geroniomo has like 200+ modules and we are already pushing the envelope
> wrt windows paht length limitations with "org.apache.geronimo". In some
> cases I think we are 10-30 chars away from breaching the limit, which
> does end up biting us from time to time. Anyways, that is our problem,
> not all of Apache's.
>
> IMO, there is no reason to prefix each and every artifact's filename
> produce by an ASF project with "apache-"... assembly zip/tgz okay,
> maybe... but for other Maven artifacts I belive that the org.apache
> groupId should be sufficient.
IMHO is not about your opinion or my opinion, it is about what ASF
lawyers can do to prevent others to distribute "fake" versions of our
products.
One of the tools ASF can use is the trademark law and to do that we have
to use "apache" in the file name.
Why should Maven artifacts follow a different procedure that other
redistributable packages? As maven repositories do redistribute
artifacts it would really help to have this apache prefix. ActiveMQ just
followed this practice (apache-activemq in the artifactId). Our to be
released Mime4J has just been updated to artifactId=apache-mime4j. If
maven or the repository does not give us another option I think the only
option we (we: PMC wanting to team with ASF in order to protect our
rights) have is to change all of our artifactIds. I don't like this too
much, but if we don't have any better technical solution to this policy
advice I will do that (and I hope others PMC too).
Btw, as I know ant/ivy/osgi/maven people is discussing repositories I
just think this is an important advice from the ASF and I hope people
will take this into consideration.
We all already loose so much time discussing and managing
NOTICE/LICENSE/headers/ICLA/CCLA/copyrights and whatever that it would
be a pity if ASF could not defend our work because of a silly missing
prefix.
Stefano
PS: if you are a lawyer then forget about what I wrote and please get in
touch with Robert because you have different convictions. I don't have
the skills to evaluate the legal impact of using or not using the
prefix, I'm just trying to find the best technical solution to a
requirement.
Re: artifactIds and "apache-" prefix for trademark-enabled artifacts
Posted by Jason Dillon <ja...@planet57.com>.
It would be a incredible pity if we had to prefix *every artifact*
with "apache-". I believe that wrt to Maven artifacts that the
"org.apache." groupId prefix should suffice. Perhaps for
distribution assemblies if we want to prefix everything with
"apache-" that should be fine (which it would be nice to get some
official clarification and documentation on this policy) .
But., for the artifacts themselves... do we really need this? Apache
Geroniomo has like 200+ modules and we are already pushing the
envelope wrt windows paht length limitations with
"org.apache.geronimo". In some cases I think we are 10-30 chars away
from breaching the limit, which does end up biting us from time to
time. Anyways, that is our problem, not all of Apache's.
IMO, there is no reason to prefix each and every artifact's filename
produce by an ASF project with "apache-"... assembly zip/tgz okay,
maybe... but for other Maven artifacts I belive that the org.apache
groupId should be sufficient.
--jason
On May 14, 2007, at 1:45 AM, Stefano Bagnara wrote:
> Yesterday I was talking to Robert Burrell Donkin on Apache JAMES dev
> list about a work-in-progress release of our mime4j product.
>
> You can read the whole thread:
> http://mail-archives.apache.org/mod_mbox/james-server-dev/
> 200705.mbox/%
> 3cf470f68e0705130612p6daba5cdve31969c139a8427e@mail.gmail.com%3e
>
> A summary is that there is an (maybe unwritten) ASF policy
> requiring us
> to use the "apache-" prefix in every redistributable artifact so to
> enable trademark law to be used against anyone passing off bad
> packages.
>
> Browsing the apache m2 repository I found very few products using the
> prefix.
>
> Of course the short-term solution is to add the "apache-" prefix to
> all
> of our artifactId but I wanted to spread the word and to hear your
> suggestions on how to make this "policy" more widely adopted by ASF
> products.
>
> E.g: maybe that an apache m2 plugin could be developed to check
> that the
> artifactId begins with "apache-" or complain with a text and added to
> the apache root pom? I think that similar technical solutions are much
> more effective than any documentation page :-)
>
> Stefano
>